Make tshark undissect the data layer

liron
1

Hi, Is there any option to run tshark without dissecting the data layer? I want to get the bytes or hex of the data layer in my json output

Thanks!

191 ●73 ●3

Use the option --disable-protocol to stop dissecting that protocol and treat it as data instead.

Comments

Thank you for your answer! Is there any way to disable all the data layer protocols at once? Or I must disable only specific ptorocols?

liron ( 2022-11-28 22:28:54 +0000 )edit

That depends on what you mean by "data layer protocol":

For 'data link layer protocol' it is probably easier to list the protocols like --disable-protocol eth
For protocols on top of TCP you can use the 'decode as' option: -d tcp.port==0-65535,data

André ( 2022-11-29 18:55:41 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.